What this check looks at
“sp= covers your subdomains; pct= controls how much of your mail the policy applies to.” - the wording shown beside this check while it runs.
sp=- The policy for your subdomains. If you leave it out, subdomains inherit the main policy - which is usually what you want. If you set it to
none, you have opened every subdomain while the main domain looks protected. pct=- The percentage of failing mail the policy is applied to. It defaults to 100. It exists so you can roll enforcement out gradually.
Why it matters
These two tags are where a policy quietly means less than it appears to. p=reject
with sp=none protects the domain and leaves invoices.yourdomain.com
wide open - and an attacker reads your DNS as easily as you do.
pct=10 with p=reject means nine out of ten forged messages are
delivered. As a deliberate first week of a rollout that is sensible. Left in place for a year,
it is a policy that reads as strict and behaves as almost nothing.
What each verdict means here
- Pass
- Subdomains are covered and the policy applies to all of your mail.
- Warn
- A weaker subdomain policy than the main one, or a percentage below 100 - deliberate during a rollout, a gap if it was forgotten.
- Not applicable
- There is no DMARC record for these tags to sit in yet.
What to do
- Unless you have a specific reason, leave
sp=out and let subdomains inherit the policy you worked to earn. - If a subdomain genuinely needs a weaker policy, set it on that subdomain rather than weakening every subdomain at once.
- Use
pct=deliberately and put a date on removing it. Raise it to 100 as soon as the reports stay clean.
What this check does not do
We read the tags on the domain you asked about. We do not enumerate your subdomains - there is no way to list them from DNS - so we cannot tell you which ones are currently sending mail.